@andorra-labs/code 0.0.0-stage → 0.1.5

package/dist/src/qa/profile/ProjectInspector.js

@@ -0,0 +1,295 @@
+import { createHash } from 'node:crypto';
+import { opendir, readFile, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { loadQaConfig } from './QaConfigLoader.js';
+import { DEFAULT_AUTO_REPAIR, DEFAULT_MERGE_GATE, DEFAULT_SECURITY, QA_EXCLUDED_DIRS } from './QaProfile.js';
+const READ_LIMIT = 524_288;
+const MARKERS = [
+    { file: 'package.json', kind: 'node-package' }, { file: 'pnpm-lock.yaml', kind: 'pnpm-lock' },
+    { file: 'package-lock.json', kind: 'npm-lock' }, { file: 'yarn.lock', kind: 'yarn-lock' },
+    { file: 'bun.lock', kind: 'bun-lock' }, { file: 'bun.lockb', kind: 'bun-lock' },
+    { file: 'pyproject.toml', kind: 'python' }, { file: 'requirements.txt', kind: 'python' }, { file: 'pytest.ini', kind: 'pytest' },
+    { file: 'Cargo.toml', kind: 'rust' }, { file: 'go.mod', kind: 'go' }, { file: 'pom.xml', kind: 'maven' },
+    { file: 'build.gradle', kind: 'gradle' }, { file: 'build.gradle.kts', kind: 'gradle' },
+    { file: 'tsconfig.json', kind: 'typescript' }, { file: 'jsconfig.json', kind: 'javascript' },
+    { file: 'eslint.config.js', kind: 'eslint' }, { file: 'eslint.config.mjs', kind: 'eslint' },
+    { file: 'eslint.config.cjs', kind: 'eslint' }, { file: '.eslintrc', kind: 'eslint' }, { file: '.eslintrc.json', kind: 'eslint' }, { file: '.eslintrc.js', kind: 'eslint' },
+    { file: 'biome.json', kind: 'biome' }, { file: 'biome.jsonc', kind: 'biome' },
+    { file: 'ruff.toml', kind: 'ruff' }, { file: '.ruff.toml', kind: 'ruff' },
+    { file: 'jest.config.js', kind: 'jest' }, { file: 'jest.config.cjs', kind: 'jest' }, { file: 'jest.config.mjs', kind: 'jest' }, { file: 'jest.config.ts', kind: 'jest' },
+    { file: 'vitest.config.ts', kind: 'vitest' }, { file: 'vitest.config.js', kind: 'vitest' }, { file: 'vitest.config.mjs', kind: 'vitest' },
+    { file: 'playwright.config.ts', kind: 'playwright' }, { file: 'playwright.config.js', kind: 'playwright' }, { file: 'playwright.config.mjs', kind: 'playwright' },
+    { file: 'Dockerfile', kind: 'docker' }, { file: 'docker-compose.yml', kind: 'docker' }, { file: 'docker-compose.yaml', kind: 'docker' },
+    { file: 'Makefile', kind: 'make' }, { file: '.golangci.yml', kind: 'golangci' }, { file: '.golangci.yaml', kind: 'golangci' },
+    { file: 'ruff.toml', kind: 'ruff' },
+];
+/** Extension probes for repositories whose language is evident only from sources. */
+const SOURCE_EXTENSIONS = ['.ts', '.tsx', '.py', '.rs', '.go', '.java', '.cs', '.php', '.rb'];
+async function probe(workspace, rel) {
+    try {
+        const abs = path.join(workspace, rel);
+        const info = await stat(abs);
+        if (!info.isFile())
+            return undefined;
+        return { rel: rel.split(path.sep).join('/'), abs, size: info.size, mtimeMs: info.mtimeMs };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Bounded extension census; skips generated and vendored trees. */
+async function censusExtensions(workspace) {
+    const counts = new Map();
+    let entries = 0;
+    const walk = async (directory, depth) => {
+        if (depth > 6 || entries > 3_000)
+            return;
+        let handle;
+        try {
+            handle = await opendir(path.join(workspace, directory));
+        }
+        catch {
+            return;
+        }
+        for await (const entry of handle) {
+            if (++entries > 3_000)
+                return;
+            if (entry.isSymbolicLink() || QA_EXCLUDED_DIRS.has(entry.name))
+                continue;
+            const rel = directory === '.' ? entry.name : `${directory}/${entry.name}`;
+            if (entry.isDirectory())
+                await walk(rel, depth + 1);
+            else {
+                const ext = path.extname(entry.name).toLowerCase();
+                if (SOURCE_EXTENSIONS.includes(ext))
+                    counts.set(ext, (counts.get(ext) ?? 0) + 1);
+            }
+        }
+    };
+    await walk('.', 0);
+    return counts;
+}
+async function findExtension(workspace, extensions, limit = 500) {
+    let entries = 0;
+    const walk = async (directory, depth) => {
+        if (depth > 6 || entries > limit)
+            return undefined;
+        let handle;
+        try {
+            handle = await opendir(path.join(workspace, directory));
+        }
+        catch {
+            return undefined;
+        }
+        for await (const entry of handle) {
+            if (++entries > limit)
+                return undefined;
+            if (entry.isSymbolicLink() || QA_EXCLUDED_DIRS.has(entry.name))
+                continue;
+            const rel = directory === '.' ? entry.name : `${directory}/${entry.name}`;
+            if (entry.isDirectory()) {
+                const found = await walk(rel, depth + 1);
+                if (found)
+                    return found;
+            }
+            else if (extensions.some(extension => entry.name.toLowerCase().endsWith(extension)))
+                return rel;
+        }
+        return undefined;
+    };
+    return walk('.', 0);
+}
+async function readJson(workspace, presence) {
+    if (!presence || presence.size > READ_LIMIT)
+        return undefined;
+    try {
+        const value = JSON.parse(await readFile(presence.abs, 'utf8'));
+        return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const matches = (scripts, patterns) => scripts.find(script => patterns.some(pattern => pattern.test(script)));
+function packageManager(pkg, found) {
+    const declared = typeof pkg?.packageManager === 'string' ? pkg.packageManager.split('@')[0] : undefined;
+    if (declared && ['npm', 'pnpm', 'yarn', 'bun'].includes(declared))
+        return declared;
+    if (found.has('pnpm-lock'))
+        return 'pnpm';
+    if (found.has('yarn-lock'))
+        return 'yarn';
+    if (found.has('bun-lock'))
+        return 'bun';
+    return 'npm';
+}
+/**
+ * Derive a QA profile from repository markers, then overlay `.andorra/qa.yaml`.
+ * Generated defaults work without the config file; explicit config always wins.
+ */
+export async function deriveProfile(workspace) {
+    const present = new Map();
+    const fingerprint = createHash('sha1');
+    const stamp = [];
+    for (const marker of MARKERS) {
+        const presence = await probe(workspace, marker.file);
+        if (presence && !present.has(marker.file)) {
+            present.set(marker.file, presence);
+            stamp.push(`${presence.rel}:${presence.size}:${Math.round(presence.mtimeMs)}`);
+        }
+    }
+    const dotnetProject = await findExtension(workspace, ['.csproj', '.sln']);
+    if (dotnetProject) {
+        const presence = await probe(workspace, dotnetProject);
+        if (presence) {
+            present.set(dotnetProject, presence);
+            stamp.push(`${presence.rel}:${presence.size}:${Math.round(presence.mtimeMs)}`);
+        }
+    }
+    const found = new Set([...present.keys()].map(file => MARKERS.find(entry => entry.file === file)?.kind ?? 'dotnet'));
+    const pkg = await readJson(workspace, present.get('package.json'));
+    const scripts = pkg && typeof pkg.scripts === 'object' && pkg.scripts ? Object.keys(pkg.scripts) : [];
+    const scriptMap = (pkg?.scripts ?? {});
+    const dependencies = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
+    let language = 'unknown';
+    if (found.has('typescript') || scripts.length && Object.keys(dependencies).some(dep => ['typescript'].includes(dep)))
+        language = 'typescript';
+    else if (found.has('node-package') || found.has('javascript'))
+        language = 'javascript';
+    else if (found.has('python') || found.has('pytest'))
+        language = 'python';
+    else if (found.has('rust'))
+        language = 'rust';
+    else if (found.has('go'))
+        language = 'go';
+    else if (dotnetProject)
+        language = 'dotnet';
+    else if (found.has('maven') || found.has('gradle'))
+        language = 'java';
+    if (language === 'unknown') {
+        const census = await censusExtensions(workspace);
+        const ranked = [...census.entries()].sort((a, b) => b[1] - a[1]);
+        const winner = ranked.find(([, count]) => count >= 3);
+        if (winner) {
+            const ext = winner[0];
+            language = ext === '.ts' || ext === '.tsx' ? 'typescript' : ext === '.py' ? 'python' : ext === '.rs' ? 'rust'
+                : ext === '.go' ? 'go' : ext === '.java' ? 'java' : ext === '.cs' ? 'dotnet' : ext === '.php' ? 'php'
+                    : ext === '.rb' ? 'ruby' : 'javascript';
+        }
+    }
+    const frameworkOrder = [
+        ['electron', /^electron$/], ['nextjs', /^next$/], ['nuxt', /^nuxt$/], ['angular', /^@angular\/core$/],
+        ['nestjs', /^@nestjs\/core$/], ['express', /^express$/], ['fastify', /^fastify$/], ['svelte', /^svelte(-kit)?$/],
+        ['vue', /^vue$/], ['react', /^react$/], ['vite', /^vite$/],
+    ];
+    const framework = frameworkOrder.find(([, pattern]) => Object.keys(dependencies).some(dep => pattern.test(dep)))?.[0];
+    const playwright = Boolean(dependencies['@playwright/test'] || dependencies.playwright)
+        || [...present.keys()].some(file => file.startsWith('playwright.config'));
+    const runCommand = (key) => {
+        const pm = packageManager(pkg, found);
+        if (pm === 'yarn')
+            return `yarn ${key}`;
+        if (key === 'test')
+            return `${pm} test`;
+        return `${pm} run ${key}`;
+    };
+    const spec = (command, timeoutMs) => ({ command, ...(timeoutMs !== undefined ? { timeoutMs } : {}) });
+    const qa = {};
+    const lintKey = matches(scripts, [/^lint$/, /^lint:.*$/, /^check:lint$/, /^lint:check$/, /^style$/, /^format:check$/]);
+    if (lintKey)
+        qa.lint = spec(runCommand(lintKey));
+    else if (found.has('eslint'))
+        qa.lint = spec('npx eslint .');
+    else if (found.has('biome'))
+        qa.lint = spec('npx biome check .');
+    else if (language === 'python' && found.has('ruff'))
+        qa.lint = spec('ruff check .');
+    const typecheckKey = matches(scripts, [/^typecheck$/, /^type-check$/, /^types$/, /^check$/, /^tsc$/]);
+    if (typecheckKey)
+        qa.typecheck = spec(runCommand(typecheckKey));
+    else if (language === 'typescript' && present.has('tsconfig.json'))
+        qa.typecheck = spec('npx tsc --noEmit');
+    else if (language === 'rust')
+        qa.typecheck = spec('cargo check');
+    else if (language === 'go')
+        qa.typecheck = spec('go vet ./...');
+    else if (language === 'python' && found.has('ruff'))
+        qa.typecheck = spec('ruff check .');
+    let runner;
+    const unitKey = matches(scripts, [/^test$/, /^test:unit$/, /^unit$/]);
+    if (unitKey)
+        qa.unit = spec(runCommand(unitKey));
+    else if (language === 'python')
+        qa.unit = spec('python -m pytest');
+    else if (language === 'rust')
+        qa.unit = spec('cargo test');
+    else if (language === 'go')
+        qa.unit = spec('go test ./...');
+    else if (language === 'dotnet')
+        qa.unit = spec('dotnet test');
+    else if (language === 'java' && found.has('maven'))
+        qa.unit = spec('mvn -q test');
+    else if (language === 'java' && found.has('gradle'))
+        qa.unit = spec('gradle test');
+    if (qa.unit) {
+        const unitCommand = qa.unit.command;
+        runner = found.has('jest') || /\bjest\b/.test(unitCommand) ? 'jest'
+            : found.has('vitest') || /\bvitest\b/.test(unitCommand) ? 'vitest'
+                : /\bnode\b[^|]*--test\b/.test(unitCommand) || /\.test\.[cm]?[jt]s(\s|$)/.test(unitCommand) ? 'node'
+                    : language === 'python' ? 'pytest' : 'other';
+    }
+    const buildKey = matches(scripts, [/^build$/, /^dist$/, /^compile$/, /^package$/]);
+    if (buildKey)
+        qa.build = spec(runCommand(buildKey));
+    else if (language === 'rust')
+        qa.build = spec('cargo build');
+    else if (language === 'go')
+        qa.build = spec('go build ./...');
+    else if (language === 'dotnet')
+        qa.build = spec('dotnet build');
+    else if (language === 'java' && found.has('maven'))
+        qa.build = spec('mvn -q package');
+    else if (language === 'java' && found.has('gradle'))
+        qa.build = spec('gradle build');
+    const e2eKey = matches(scripts, [/^(test:)?e2e$/, /^e2e:.*$/]);
+    if (e2eKey)
+        qa.e2e = spec(runCommand(e2eKey));
+    else if (playwright)
+        qa.e2e = spec('npx playwright test');
+    let config;
+    let configError;
+    try {
+        config = await loadQaConfig(workspace);
+    }
+    catch (error) {
+        configError = error instanceof Error ? error.message : String(error);
+    }
+    if (config) {
+        for (const [name, value] of Object.entries(config.qa))
+            if (value)
+                qa[name] = value;
+        stamp.push(...config.sources.map(source => `${source}:configured`));
+    }
+    const profile = {
+        project: { language, ...(framework ? { framework } : {}), packageManager: language === 'javascript' || language === 'typescript' ? packageManager(pkg, found) : undefined, detectedFiles: [...present.keys()].sort() },
+        qa,
+        test: config?.test ?? (runner ? { runner } : undefined),
+        startup: config?.startup,
+        security: config?.security ?? { ...DEFAULT_SECURITY },
+        browser: {
+            ...(playwright ? { framework: 'playwright' } : {}),
+            enabled: config?.browser.enabled ?? playwright,
+            url: config?.browser.url ?? config?.startup?.healthUrl,
+            ignoredConsolePatterns: config?.browser.ignoredConsolePatterns ?? [],
+            allowedHttpErrors: config?.browser.allowedHttpErrors ?? [],
+            accessibility: config?.browser.accessibility ?? false,
+        },
+        mergeGate: config?.mergeGate ?? [...DEFAULT_MERGE_GATE],
+        autoRepair: config?.autoRepair ?? { ...DEFAULT_AUTO_REPAIR },
+        apiSmokeTests: config?.apiSmokeTests ?? [],
+        sources: [...[...present.keys()].sort().slice(0, 12), ...(config?.sources ?? [])],
+        ...(configError ? { configError } : {}),
+    };
+    fingerprint.update([...stamp].sort().join('\n'));
+    return { profile, fingerprint: fingerprint.digest('hex') };
+}

package/dist/src/qa/profile/QaConfigLoader.d.ts

@@ -0,0 +1,43 @@
+import type { QaApiSmokeTest, QaCommandSpec, QaSeverityCascade, QaStartupSpec } from '../types.js';
+/** Loaded repository QA configuration; undefined when no .andorra/qa.yaml exists. */
+export interface QaRepoConfig {
+    qa: Partial<Record<'lint' | 'typecheck' | 'unit' | 'build' | 'e2e', QaCommandSpec>>;
+    test?: {
+        runner?: 'jest' | 'vitest' | 'node' | 'pytest' | 'other';
+        relatedCommand?: string;
+        patternCommand?: string;
+    };
+    startup?: QaStartupSpec;
+    security: {
+        dependencyScan: boolean;
+        secretScan: boolean;
+        semgrep: boolean;
+        failOn: QaSeverityCascade[];
+    };
+    mergeGate?: string[];
+    autoRepair: {
+        enabled: boolean;
+        maxAttemptsPerCheck: number;
+    };
+    browser: {
+        enabled?: boolean;
+        url?: string;
+        ignoredConsolePatterns: string[];
+        allowedHttpErrors: {
+            path: string;
+            status: number;
+        }[];
+        accessibility: boolean;
+    };
+    apiSmokeTests: QaApiSmokeTest[];
+    sources: string[];
+}
+export declare const QA_CONFIG_RELATIVE_PATH: string;
+/**
+ * Parse and strictly validate the repository's `.andorra/qa.yaml`.
+ * Unknown keys and invalid values fail loudly: a half-understood config is worse
+ * than none, and generated defaults already work without this file.
+ */
+export declare function parseQaConfig(source: string): QaRepoConfig;
+/** Load `.andorra/qa.yaml` from a workspace; undefined when absent. Throws on invalid content. */
+export declare function loadQaConfig(workspace: string): Promise<QaRepoConfig | undefined>;

package/dist/src/qa/profile/QaConfigLoader.js

@@ -0,0 +1,261 @@
+import { readFile, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { parseYaml, YamlError } from './yaml.js';
+import { DEFAULT_SECURITY, DEFAULT_AUTO_REPAIR, MERGE_GATE_IDS } from './QaProfile.js';
+export const QA_CONFIG_RELATIVE_PATH = path.posix.join('.andorra', 'qa.yaml');
+const CHECK_KEYS = ['lint', 'typecheck', 'unit', 'build', 'e2e'];
+const GATE_KEYS = new Set(MERGE_GATE_IDS);
+const SEVERITIES = new Set(['critical', 'high', 'moderate', 'low']);
+const TEST_RUNNERS = new Set(['jest', 'vitest', 'node', 'pytest', 'other']);
+const HTTP_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']);
+function fail(key, detail) {
+    throw new Error(`${QA_CONFIG_RELATIVE_PATH}: ${key} ${detail}`);
+}
+function object(value, key) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'object' || Array.isArray(value))
+        fail(key, 'must be a mapping');
+    return value;
+}
+function text(value, key, allowEmpty = false) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'string' || (!allowEmpty && !value.trim()))
+        fail(key, 'must be a nonempty string');
+    return value;
+}
+function flag(value, key) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'boolean')
+        fail(key, 'must be true or false');
+    return value;
+}
+function integer(value, key, min, max) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (!Number.isSafeInteger(value) || value < min || value > max)
+        fail(key, `must be an integer from ${min} to ${max}`);
+    return value;
+}
+function stringList(value, key, max) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (!Array.isArray(value) || value.some(item => typeof item !== 'string' || !item.trim() || item.length > 200) || value.length > max) {
+        fail(key, `must be an array of at most ${max} nonempty strings`);
+    }
+    return value;
+}
+function knownKeys(target, allowed, key) {
+    for (const name of Object.keys(target))
+        if (!allowed.includes(name))
+            fail(key ? `${key}.${name}` : name, 'is not a supported key');
+}
+/**
+ * Parse and strictly validate the repository's `.andorra/qa.yaml`.
+ * Unknown keys and invalid values fail loudly: a half-understood config is worse
+ * than none, and generated defaults already work without this file.
+ */
+export function parseQaConfig(source) {
+    const raw = parseYaml(source);
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        throw new Error(`${QA_CONFIG_RELATIVE_PATH}: root must be a mapping`);
+    knownKeys(raw, ['version', 'qa', 'browser', 'api_smoke_tests'], '');
+    if (raw.version !== undefined && raw.version !== 1)
+        fail('version', 'must be 1');
+    const config = {
+        qa: {},
+        security: { ...DEFAULT_SECURITY },
+        autoRepair: { ...DEFAULT_AUTO_REPAIR },
+        browser: { ignoredConsolePatterns: [], allowedHttpErrors: [], accessibility: false },
+        apiSmokeTests: [],
+        sources: [],
+    };
+    const qa = object(raw.qa, 'qa');
+    if (qa) {
+        knownKeys(qa, [...CHECK_KEYS, 'startup', 'security', 'test', 'merge_gate', 'auto_repair'], 'qa');
+        for (const name of CHECK_KEYS) {
+            const entry = qa[name];
+            if (entry === undefined || entry === null)
+                continue;
+            const spec = typeof entry === 'string' ? { command: entry } : object(entry, `qa.${name}`);
+            if (!spec)
+                continue;
+            knownKeys(spec, ['command', 'timeout_ms'], `qa.${name}`);
+            const command = text(spec.command, `qa.${name}.command`);
+            if (command === undefined)
+                fail(`qa.${name}.command`, 'is required when the check is configured');
+            const timeoutMs = integer(spec.timeout_ms, `qa.${name}.timeout_ms`, 1_000, 900_000);
+            config.qa[name] = { command, ...(timeoutMs !== undefined ? { timeoutMs } : {}) };
+        }
+        const startup = object(qa.startup, 'qa.startup');
+        if (startup) {
+            knownKeys(startup, ['command', 'health_url', 'timeout_ms'], 'qa.startup');
+            const command = text(startup.command, 'qa.startup.command');
+            if (command === undefined)
+                fail('qa.startup.command', 'is required when startup is configured');
+            const healthUrl = text(startup.health_url, 'qa.startup.health_url');
+            if (healthUrl !== undefined) {
+                try {
+                    const url = new URL(healthUrl);
+                    if (!['http:', 'https:'].includes(url.protocol))
+                        throw new Error();
+                }
+                catch {
+                    fail('qa.startup.health_url', 'must be an http(s) URL');
+                }
+            }
+            const timeoutMs = integer(startup.timeout_ms, 'qa.startup.timeout_ms', 1_000, 300_000);
+            config.startup = { command, ...(healthUrl !== undefined ? { healthUrl } : {}), ...(timeoutMs !== undefined ? { timeoutMs } : {}) };
+        }
+        const security = object(qa.security, 'qa.security');
+        if (security) {
+            knownKeys(security, ['dependency_scan', 'secret_scan', 'semgrep', 'fail_on'], 'qa.security');
+            config.security = {
+                dependencyScan: flag(security.dependency_scan, 'qa.security.dependency_scan') ?? config.security.dependencyScan,
+                secretScan: flag(security.secret_scan, 'qa.security.secret_scan') ?? config.security.secretScan,
+                semgrep: flag(security.semgrep, 'qa.security.semgrep') ?? config.security.semgrep,
+                failOn: (() => {
+                    const list = stringList(security.fail_on, 'qa.security.fail_on', 4);
+                    if (!list)
+                        return config.security.failOn;
+                    if (list.some(item => !SEVERITIES.has(item)))
+                        fail('qa.security.fail_on', 'supports critical, high, moderate and low');
+                    return list;
+                })(),
+            };
+        }
+        const test = object(qa.test, 'qa.test');
+        if (test) {
+            knownKeys(test, ['runner', 'related_command', 'pattern_command'], 'qa.test');
+            const runner = text(test.runner, 'qa.test.runner');
+            if (runner !== undefined && !TEST_RUNNERS.has(runner))
+                fail('qa.test.runner', 'supports jest, vitest, node, pytest or other');
+            const relatedCommand = text(test.related_command, 'qa.test.related_command');
+            const patternCommand = text(test.pattern_command, 'qa.test.pattern_command');
+            config.test = {
+                ...(runner ? { runner: runner } : {}),
+                ...(relatedCommand !== undefined ? { relatedCommand } : {}),
+                ...(patternCommand !== undefined ? { patternCommand } : {}),
+            };
+            if (!Object.keys(config.test).length)
+                delete config.test;
+        }
+        if (qa.merge_gate !== undefined && qa.merge_gate !== null) {
+            const gate = stringList(qa.merge_gate, 'qa.merge_gate', 32);
+            if (!gate)
+                fail('qa.merge_gate', 'must be an array of check names');
+            for (const name of gate)
+                if (!GATE_KEYS.has(name))
+                    fail(`qa.merge_gate entry "${name}"`, `must be one of ${MERGE_GATE_IDS.join(', ')}`);
+            config.mergeGate = gate;
+        }
+        const repair = object(qa.auto_repair, 'qa.auto_repair');
+        if (repair) {
+            knownKeys(repair, ['enabled', 'max_attempts_per_check'], 'qa.auto_repair');
+            config.autoRepair = {
+                enabled: flag(repair.enabled, 'qa.auto_repair.enabled') ?? config.autoRepair.enabled,
+                maxAttemptsPerCheck: integer(repair.max_attempts_per_check, 'qa.auto_repair.max_attempts_per_check', 1, 10) ?? config.autoRepair.maxAttemptsPerCheck,
+            };
+        }
+    }
+    const browser = object(raw.browser, 'browser');
+    if (browser) {
+        knownKeys(browser, ['enabled', 'url', 'ignored_console_patterns', 'allowed_http_errors', 'accessibility'], 'browser');
+        config.browser = {
+            enabled: flag(browser.enabled, 'browser.enabled') ?? config.browser.enabled,
+            url: text(browser.url, 'browser.url'),
+            ignoredConsolePatterns: stringList(browser.ignored_console_patterns, 'browser.ignored_console_patterns', 32) ?? [],
+            allowedHttpErrors: (() => {
+                if (browser.allowed_http_errors === undefined || browser.allowed_http_errors === null)
+                    return [];
+                if (!Array.isArray(browser.allowed_http_errors))
+                    fail('browser.allowed_http_errors', 'must be a list of {path, status}');
+                return browser.allowed_http_errors.map((entry, index) => {
+                    const item = object(entry, `browser.allowed_http_errors[${index}]`);
+                    if (!item)
+                        fail(`browser.allowed_http_errors[${index}]`, 'must be a mapping');
+                    knownKeys(item, ['path', 'status'], `browser.allowed_http_errors[${index}]`);
+                    const itemPath = text(item.path, `browser.allowed_http_errors[${index}].path`);
+                    const status = integer(item.status, `browser.allowed_http_errors[${index}].status`, 100, 599);
+                    if (itemPath === undefined || status === undefined)
+                        fail(`browser.allowed_http_errors[${index}]`, 'requires path and status');
+                    return { path: itemPath, status };
+                });
+            })(),
+            accessibility: flag(browser.accessibility, 'browser.accessibility') ?? false,
+        };
+        for (const pattern of config.browser.ignoredConsolePatterns)
+            new RegExp(pattern);
+    }
+    const smoke = raw.api_smoke_tests;
+    if (smoke !== undefined && smoke !== null) {
+        if (!Array.isArray(smoke))
+            fail('api_smoke_tests', 'must be a list');
+        if (smoke.length > 32)
+            fail('api_smoke_tests', 'supports at most 32 entries');
+        config.apiSmokeTests = smoke.map((entry, index) => {
+            const item = object(entry, `api_smoke_tests[${index}]`);
+            if (!item)
+                fail(`api_smoke_tests[${index}]`, 'must be a mapping');
+            knownKeys(item, ['name', 'request', 'expect'], `api_smoke_tests[${index}]`);
+            const name = text(item.name, `api_smoke_tests[${index}].name`);
+            const request = object(item.request, `api_smoke_tests[${index}].request`);
+            if (!name || !request)
+                fail(`api_smoke_tests[${index}]`, 'requires name and request');
+            knownKeys(request, ['method', 'url', 'headers', 'body'], `api_smoke_tests[${index}].request`);
+            const method = text(request.method, `api_smoke_tests[${index}].request.method`);
+            const url = text(request.url, `api_smoke_tests[${index}].request.url`);
+            if (!method || !HTTP_METHODS.has(method) || !url)
+                fail(`api_smoke_tests[${index}].request`, 'requires a valid method and url');
+            try {
+                const parsed = new URL(url);
+                if (!['http:', 'https:'].includes(parsed.protocol))
+                    throw new Error();
+            }
+            catch {
+                fail(`api_smoke_tests[${index}].request.url`, 'must be http(s)');
+            }
+            let headers;
+            if (request.headers !== undefined && request.headers !== null) {
+                const map = object(request.headers, `api_smoke_tests[${index}].request.headers`);
+                if (!map || Object.entries(map).some(([, value]) => typeof value !== 'string'))
+                    fail(`api_smoke_tests[${index}].request.headers`, 'must be a string map');
+                headers = map;
+            }
+            const body = text(request.body, `api_smoke_tests[${index}].request.body`, true);
+            let expect;
+            const expectBlock = object(item.expect, `api_smoke_tests[${index}].expect`);
+            if (expectBlock) {
+                knownKeys(expectBlock, ['status', 'body_contains'], `api_smoke_tests[${index}].expect`);
+                const status = integer(expectBlock.status, `api_smoke_tests[${index}].expect.status`, 100, 599);
+                const bodyContains = text(expectBlock.body_contains, `api_smoke_tests[${index}].expect.body_contains`);
+                expect = { ...(status !== undefined ? { status } : {}), ...(bodyContains !== undefined ? { bodyContains } : {}) };
+            }
+            return { name, request: { method: method, url, ...(headers ? { headers } : {}), ...(body !== undefined ? { body } : {}) }, ...(expect && Object.keys(expect).length ? { expect } : {}) };
+        });
+    }
+    return config;
+}
+/** Load `.andorra/qa.yaml` from a workspace; undefined when absent. Throws on invalid content. */
+export async function loadQaConfig(workspace) {
+    const file = path.join(workspace, ...QA_CONFIG_RELATIVE_PATH.split('/'));
+    try {
+        const info = await stat(file);
+        if (!info.isFile())
+            return undefined;
+        if (info.size > 65_536)
+            throw new Error(`${QA_CONFIG_RELATIVE_PATH}: config exceeds 65536 bytes`);
+        const config = parseQaConfig(await readFile(file, 'utf8'));
+        config.sources = [QA_CONFIG_RELATIVE_PATH];
+        return config;
+    }
+    catch (error) {
+        if (error instanceof YamlError)
+            throw new Error(`${QA_CONFIG_RELATIVE_PATH}: ${error.message}`);
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}

package/dist/src/qa/profile/QaProfile.d.ts

@@ -0,0 +1,17 @@
+import type { QaSeverityCascade } from '../types.js';
+/** Merge-gate check identifiers, in default execution order. */
+export declare const MERGE_GATE_IDS: readonly ["lint", "typecheck", "related_tests", "build", "diff_review", "secret_scan", "dependency_audit", "runtime_smoke", "browser_smoke", "console_errors", "network_errors", "api_smoke", "contract_validation", "migration_validation", "accessibility", "visual_regression", "semgrep"];
+/** Plan §47 default production gate for repositories that do not override it. */
+export declare const DEFAULT_MERGE_GATE: readonly ["lint", "typecheck", "related_tests", "build", "diff_review", "secret_scan"];
+export declare const DEFAULT_SECURITY: {
+    dependencyScan: boolean;
+    secretScan: boolean;
+    semgrep: boolean;
+    failOn: QaSeverityCascade[];
+};
+export declare const DEFAULT_AUTO_REPAIR: {
+    enabled: boolean;
+    maxAttemptsPerCheck: number;
+};
+/** Marker directories excluded from QA scans and change analysis. */
+export declare const QA_EXCLUDED_DIRS: Set<string>;

package/dist/src/qa/profile/QaProfile.js

@@ -0,0 +1,15 @@
+/** Merge-gate check identifiers, in default execution order. */
+export const MERGE_GATE_IDS = [
+    'lint', 'typecheck', 'related_tests', 'build', 'diff_review', 'secret_scan',
+    'dependency_audit', 'runtime_smoke', 'browser_smoke', 'console_errors', 'network_errors',
+    'api_smoke', 'contract_validation', 'migration_validation', 'accessibility', 'visual_regression',
+    'semgrep',
+];
+/** Plan §47 default production gate for repositories that do not override it. */
+export const DEFAULT_MERGE_GATE = ['lint', 'typecheck', 'related_tests', 'build', 'diff_review', 'secret_scan'];
+export const DEFAULT_SECURITY = {
+    dependencyScan: true, secretScan: true, semgrep: false, failOn: ['critical', 'high'],
+};
+export const DEFAULT_AUTO_REPAIR = { enabled: true, maxAttemptsPerCheck: 3 };
+/** Marker directories excluded from QA scans and change analysis. */
+export const QA_EXCLUDED_DIRS = new Set(['.git', 'node_modules', '.andorracode', '.andorra', 'dist', 'build', 'out', 'coverage', '.next', 'vendor']);

package/dist/src/qa/profile/yaml.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Indentation-based YAML subset for `.andorra/qa.yaml`.
+ *
+ * Supports maps, `- ` lists (of scalars or items starting with a key, whose nested
+ * blocks align at dash+2 columns), inline scalar arrays `[a, b]`, quoted/plain
+ * scalars, integers, booleans and null. Tabs, anchors, flow maps and multi-line
+ * scalars are rejected loudly so a config the loader cannot fully understand
+ * never half-applies.
+ */
+export declare class YamlError extends Error {
+}
+export declare function parseYaml(text: string): unknown;